71–80 of 328 posts
Genuinely curious, why not name the bank here? It certainly isn't going to be news to the bank itself, so there aren't responsible disclosure concerns here. And since the top advice here is to leave the bank, wouldn't the best thing you can do be to alert the public, so others can protect themselves as well?
Looks like it’s PNC. Everyone here, move your money now.
Wow. Did they repeat your password or some hint you typed in a long time ago? FWIW I have seen two companies that store passwords properly in a one way hash with salt but store statistics on every password like number of case changes and count of numbers and total length. I personally think that practice is infinitely stupid but can explain why they can say it has 3 numbers in it. One major marketing firm I did work…
They're a three letter acronym that starts with P and ends with C.
Earlier quoted context omitted.
The same reason you might be concerned even if a doctor can deliver a baby safely despite not washing his hands in between a cadaver examination and touching your wife. Do you feel lucky? Well, do ya?
Sure, If the doctor can deliver baby safely and not causing any other damage despite not washing hands then what's the issue? That's why I asked what is the actual damage. Is the money is stolen ? Is the money can't be accessed ? If the bank doesn't do me any actual damage despite the clear text password then I don't see why I should be concerned. I guess I can see that for some people, clear text password usage can…
Imagine you worked in a building for a week and didn’t die in a fire. Would you have a problem with discovering that the writing was done by a amateur, there were piles of lint and fabric everywhere, and there was only one revolving-door exit?
If yes, then you understand the problem of risk and its just a question of magnitude.
If not, then you should be aware that you see the world dramatically differently than most people.
Santander in the UK does this too. You can tell because they only ask for 3 characters out of your password whenever you log in. What's ironic is that whoever did that propably thought they were being super clever.
Is it not possible to verify positional characters without storing in plain text ? off the top of my head, something like storing your full password salted + hashed along side each char salted + hashed.
Wait, that alone doesn't necessarily indicate that they're storing clear text passwords. I notice you didn't say that they just repeated your password to you-- why do you think they store the whole thing in clear text?
HN readers are apt to demand hardcore passphrases, salting, 2FA, etc. But the reality is that banks have to deal with all kinds of people and situations. Your security as a bank customer hinges on more than just one password, it's also about monitoring patterns of behavior, being aware of what's coming and going from your account, and protection mechanisms like the bank's insurance.
That said, one would think that large institutions have learned their lesson about clear text passwords, perhaps this one hasn't? Is there a law against clear text passwords? How does anyone actually know if a financial institution has sound IT practices, by happenstance incidents like this? Really?
Why not reach out to someone like Brian Krebs? He has a pretty large reach and can potentially make people take notice. Try @briankrebs on Twitter.
He runs the @haveibeenpwned service
> The service rep proceeded to (accurately) describe my own password to me. Wait, that alone doesn't necessarily indicate that they're storing clear text passwords. I notice you didn't say that they just repeated your password to you-- why do you think they store the whole thing in clear text? HN readers are apt to demand hardcore passphrases, salting, 2FA, etc. But the reality is that banks have to deal with all kin…
Some banks do this better than others from past experience. For example, I definitely have Bank of America notify me when I do something out of the ordinary. I had gone to a gas station and then my next purchase was pricey and online based. They put that on hold till I confirmed it was by me. They also have done so when I get gas from outside of town.
Other banks just cough up the money without a second thought. I'm sure they might have other "triggers" but it feels like mainly really the big players have proper security setup.
This is why I mostly use my credit card and pay for it before the statement is due. You have better protection on a credit card than you do on a debit card. I wouldn't use my debit card outside of an ATM.
You should report to proper authorities about the severity of the issue. Reach out to their security or technical higher up department of the bank. In your case, they may or may not be storing the password in cleartext. They might be using the two way encryption instead of one-way hash. Passwords should be hashed (with salt) and it is irreversible. For a financial institution, revealing your password by a customer se…
> You should report to proper authorities about the severity of the issue. Reach out to their security or technical higher up department of the bank. Switch your bank. Do not reach out to the bank's security/technical! There's a non-zero chance that the response from the bank would be to reach out to the FBI and claim that you are the "hacker". It will create an enormous headache for you. If you are going to reach ou…
I'm not sure how the bot protection software was deployed but looking at marketing materials I suspect the data was sent to the third party as part of a SAAS service.
We believe this was accidental because a later version of the software stopped doing it. I'm not sure if there was a notification by the third party to users about this flaw.
https://banking.westpac.com.au/
I complained to them about this years ago, they replied explaining they knew what they were doing and it was a balance between security and simplicity...